Skip to contentGo-vikunja Vikunja vulnerabilities
- go-vikunja vikunjaVikunja before 2.6.0 Broken Object-Level Authorization via task-positionCVE-2026-91984Fix available5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 API Token Scope Bypass via expand ParameterCVE-2026-91983Fix available5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 TOTP Secret Disclosure via APICVE-2026-91982Fix available5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 User Enumeration via v2 APICVE-2026-91981Fix available5.3 Medium
- go-vikunja vikunjavikunja before 2.6.0 Team Enumeration via Project ShareCVE-2026-91980Fix available5.3 Medium
- go-vikunja vikunjaVikunja before 2.6.0 Denial of Service via Decompression BombCVE-2026-91979Fix available7.1 High
- go-vikunja vikunjaVikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthCVE-2026-91973Fix available8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Authentication Bypass via Unthrottled APICVE-2026-91972Fix available8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Denial of Service via Avatar UploadCVE-2026-91971Fix available7.1 High
- go-vikunja vikunjaVikunja before 2.6.0 Resource Exhaustion via Planka MigrationCVE-2026-91970Fix available7.1 High
- go-vikunja vikunjavikunja before 2.6.0 Resource Exhaustion via CSV MigrationCVE-2026-91969Fix available7.1 High
- go-vikunja vikunjavikunja before 2.6.0 Denial of Service via unbounded filter recursionCVE-2026-91968Fix available7.1 High
- go-vikunja vikunjaVikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentCVE-2026-55067Fix available5.0 Medium
- go-vikunja vikunjaVikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idCVE-2026-55066Fix available7.1 High
- go-vikunja vikunjaVikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apiCVE-2026-55065Fix available8.1 High
- go-vikunja vikunjaVikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0CVE-2026-55064Fix available4.3 Medium
- go-vikunja vikunjaVikunja: Project duplication bypasses write-permission check on the target parent projectCVE-2026-54766Fix available5.3 Medium
- go-vikunja vikunjaVikunja through 2.4.0 Principal-Type Confusion via LinkSharingCVE-2026-76216Fix available7.7 High
- go-vikunja vikunjaVikunja 0.24.0 Broken Object Level Authorization via Link-Share TokenCVE-2026-68582Public exploitFix available9.3 Critical
- go-vikunja vikunjaVikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID CollisionCVE-2026-68581Fix available8.6 High
- go-vikunja vikunjaVikunja's Scoped API tokens with projects.background permission can delete project backgroundsCVE-2026-40103Fix available4.3 Medium
- go-vikunja vikunjaVikunja has a File Size Limit Bypass via Vikunja ImportCVE-2026-35602Fix available5.4 Medium
- go-vikunja vikunjaVikunja has an iCalendar Property Injection via CRLF in CalDAV Task OutputCVE-2026-35601Fix available4.1 Medium
- go-vikunja vikunjaVikunja has HTML Injection via Task Titles in Overdue Email NotificationsCVE-2026-35600Fix available5.4 Medium
- go-vikunja vikunjaVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerCVE-2026-35599Fix available6.5 Medium
- go-vikunja vikunjaVikunja has Missing Authorization on CalDAV Task ReadCVE-2026-35598Fix available4.3 Medium
- go-vikunja vikunjaVikunja Affected by TOTP Brute-Force Due to Non-Functional Account LockoutCVE-2026-35597Fix available5.9 Medium
- go-vikunja vikunjaVikunja has Broken Access Control on Label Read via SQL Operator Precedence BugCVE-2026-35596Fix available4.3 Medium
- go-vikunja vikunjaVikunja Affected by Privilege Escalation via Project ReparentingCVE-2026-35595Fix available8.3 High
- go-vikunja vikunjaVikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeCVE-2026-35594Fix available6.5 Medium
- go-vikunja vikunjaVikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login PathCVE-2026-34727Fix available7.4 High
- go-vikunja vikunjaVikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDORCVE-2026-56765Fix available9.3 Critical
- go-vikunja vikunjaVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share DeletionCVE-2026-33700Fix available6.9 Medium
- go-vikunja vikunjaVikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission EscalationCVE-2026-33680Fix available7.5 High
- go-vikunja vikunjaVikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF ProtectionsCVE-2026-33679Fix available6.4 Medium
- go-vikunja vikunjaVikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and DeletionCVE-2026-33678Fix available8.1 High
- go-vikunja vikunjaWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APICVE-2026-33677Fix available6.5 Medium
- go-vikunja vikunjaVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task ReadCVE-2026-33676Fix available6.5 Medium
- go-vikunja vikunjaVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network ResourcesCVE-2026-33675Fix available6.4 Medium
- go-vikunja vikunjaVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID ConnectCVE-2026-33668Fix available7.1 High
- go-vikunja vikunjaVikunja Desktop vulnerable to Remote Code Execution via same-window navigationCVE-2026-333366.5 Medium
- go-vikunja vikunjaVikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalCVE-2026-333356.4 Medium
- go-vikunja vikunjaVikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegrationCVE-2026-333346.5 Medium
- go-vikunja vikunjaVikunja Affected by DoS via Image Preview GenerationCVE-2026-33474Fix available6.5 Medium
- go-vikunja vikunjaVikunja has TOTP Reuse During Validity WindowCVE-2026-33473Fix available5.7 Medium
- go-vikunja vikunjaVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementCVE-2026-333168.1 High
- go-vikunja vikunjaVikunja has a 2FA Bypass via Caldav Basic AuthCVE-2026-333156.9 Medium
- go-vikunja vikunjaVikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsCVE-2026-333135.3 Medium
- go-vikunja vikunjaRead-only Vikunja users can delete project background images via broken object-level authorizationCVE-2026-33312Fix available5.3 Medium
- go-vikunja vikunjaVikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed HeadersCVE-2026-29794Fix available5.3 Medium
- Show moreLoading…